Legal

Privacy Policy

TERRALEKHA ("we", "our", "us") is a carbon ledger for Indian exporters preparing CBAM reports. This policy explains what personal data we collect, why, who handles it, where it goes, how long we keep it, and what rights you have over it.

1. Who we are

TERRALEKHA is a product operated in India. Our contact for privacy matters, including complaints about how we handle your data, is service@terralekha.in.

2. What we collect

• Contact details — name, email address, mobile or WhatsApp number and company name, when you ask for pilot access or write to us.
• Account details — email, mobile number, name, legal and trade name of your business, GSTIN, and IEC and Udyam numbers where you give them, and your sector, when an account is opened for you.
• Documents and the figures read from them — electricity bills, fuel and material invoices and production registers you upload, and the figures read from them. These can contain names, addresses and account numbers of your business and, sometimes, of individuals.
• What people do in your workspace — who confirmed or corrected each figure, and when. The ledger keeps this record by design (see section 6).
• Technical data — IP address and request logs, used to keep the service secure and to limit abuse.

This website itself collects nothing beyond one item that remembers you acknowledged the notice at the bottom of the page. It has no analytics, advertising or third-party trackers.

3. Why we collect it

• To open and run your account, and to send you the link you sign in with.
• To read your documents and propose figures that a person then confirms, and to keep the ledger and calculate from it.
• To support you and to send service emails such as sign-in links and confirmations.
• To keep the service secure and to meet legal obligations.

4. Legal basis

Where India's Digital Personal Data Protection Act, 2023 applies, we process your data on your consent, given when your account is opened, and for the legitimate uses the Act permits. If you are in the EU, or your data is processed in connection with EU CBAM obligations, we also rely on contract performance (to deliver the service you asked for), legitimate interests (security and fraud prevention), and consent where you have given it.

5. Where your data goes and who handles it

We do not sell your data. These providers handle it for us, under their own terms and our instructions:

• Supabase — database and uploaded documents. Stored at rest in Mumbai, India (AWS ap-south-1).
• Render — runs our application. Its servers are in Singapore, so your data passes through Singapore when you use the service.
• An AI model provider (Anthropic) — your documents are sent to it, outside India, so that it can read them and propose figures. It handles one organisation's documents at a time. We do not use customer data to train models, and a figure a model proposes never enters the ledger until a person has confirmed it.
• Resend — delivers our emails, so it handles your email address and the message.
• Cloudflare — delivers this website and protects staff sign-in.
• Accredited verifiers — receive only the data needed to verify a record, under a data processing agreement, when you ask for verification.
• Importers and authorities — see only a PassPort that you choose to issue, which anyone holding its reference can read.

Our own staff can see documents when they support your account. Staff access is limited by role: our technical staff cannot see customer identity or the contents of documents.

6. How long we keep it

• Sealed records and the evidence behind them — 10 years from sealing, in line with CBAM record-keeping.
• Drafts that were never sealed — deleted 90 days after your account closes.
• Contact details of people who asked for pilot access but did not open an account — while we are in touch with you, and for up to 2 years after.
• Technical logs — 90 days.

The ledger is append-only: a confirmed figure is not deleted, it is corrected by a reversing entry that stays visible. If you ask us to delete your personal data, we delete what can be deleted, such as your account details and documents that are not part of a sealed record, and we keep sealed records and their evidence for the period above, as the law permits. Deletion is carried out by us on request.

7. Your rights

You have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Ask us to delete your data, subject to section 6.
• Withdraw consent at any time, where processing rests on consent.
• Object to processing based on legitimate interests, and receive your data in a machine-readable format (EU).
• Nominate another person to exercise these rights for you if you cannot.
• Have a complaint about our handling of your data answered.

Write to service@terralekha.in. We will respond within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India or, in the EU, to your data protection authority.

8. Security

Data is encrypted in transit. The database is access-controlled, and the ledger is tamper-evident: each entry is chained to the one before it, so a change to the past can be detected. If a breach affects your data we will tell you as the law requires.

9. Cookies

This website stores one item in your browser, to remember that you acknowledged its notice. We do not use advertising or tracking cookies. The workspace uses only the items needed to keep you signed in.

10. Changes to this policy

We will update this policy as our practices change. Material changes will be notified by email to registered users. The effective date at the top reflects the latest revision.